CVE-2023-50270 - OpenCVE

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/apache/dolphinscheduler/pull/15219
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
https://www.openwall.com/lists/oss-security/2024/02/20/3

History

Thu, 29 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-384
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-02-20T10:01:32.260Z

Updated: 2024-08-29T15:08:36.166Z

Reserved: 2023-12-06T02:25:09.094Z

Link: CVE-2023-50270

Vulnrichment

Updated: 2024-08-02T22:16:46.169Z

NVD

Status : Awaiting Analysis

Published: 2024-02-20T10:15:08.140

Modified: 2024-08-29T20:35:41.743

Link: CVE-2023-50270

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50270", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-12-06T02:25:09.094Z", "datePublished": "2024-02-20T10:01:32.260Z", "dateUpdated": "2024-08-29T15:08:36.166Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api", "product": "Apache DolphinScheduler", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.2.0", "status": "affected", "version": "1.3.8", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "lujiefsi"}, {"lang": "en", "type": "finder", "value": "Qing Xu"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue."}], "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-23T10:17:35.425Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache DolphinScheduler: Session do not expire after password change", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.169Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-384", "lang": "en", "description": "CWE-384 Session Fixation"}]}], "affected": [{"vendor": "apache", "product": "dolphinscheduler", "cpes": ["cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.3.8", "status": "affected", "lessThanOrEqual": "3.2.0", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-20T17:07:02.901267Z", "id": "CVE-2023-50270", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:08:36.166Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/apache/dolphinscheduler/pull/15219", "tags": ["patch", "x_transferred"]}, {"url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.169Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-50270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-20T17:07:02.901267Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "dolphinscheduler", "versions": [{"status": "affected", "version": "1.3.8", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384 Session Fixation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:08:30.902Z"}}], "cna": {"title": "Apache DolphinScheduler: Session do not expire after password change", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "lujiefsi"}, {"lang": "en", "type": "finder", "value": "Qing Xu"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache DolphinScheduler", "versions": [{"status": "affected", "version": "1.3.8", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/dolphinscheduler/pull/15219", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r", "tags": ["vendor-advisory"]}, {"url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-23T10:17:35.425Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50270", "state": "PUBLISHED", "dateUpdated": "2024-08-29T15:08:36.166Z", "dateReserved": "2023-12-06T02:25:09.094Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-02-20T10:01:32.260Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}